- Level
- Senior
- Experience
- Not stated
- Work style
- On-site
- Full-time
- Area
- Defence & SOC
At a glance
The role in plain English
This role involves monitoring, triaging, and responding to security incidents affecting Mastercard Vocalink's payments infrastructure in the UK. The position suits experienced analysts with a background in SOC and incident response, who can handle escalated alerts and collaborate with multiple security teams. Day-to-day tasks include incident response, process improvement, and supporting security projects, with a mix of independent and team-based work.
What you'll do
- Monitor and triage escalated security alerts (T3) from multiple sources
- Respond to cybersecurity incidents using defined playbooks
- Conduct root cause analysis and apply lessons learned
- Collaborate with security engineering, threat intelligence, and managed SOC
- Develop and improve knowledge base, playbooks, and use cases
What they're looking for
Essential
- Direct SOC experience
- Incident response or digital forensics background
- Experience in cybersecurity disciplines (e.g. threat hunting, malware analysis)
- Ability to work independently and collaboratively
Nice to have
- SIEM query and alert creation, preferably SPL
- Windows/Unix OS forensics experience
- Cloud security experience (Azure, AWS, GCP)
- CISSP or GIAC certification
Core skills
- Incident response
- SIEM
- Digital forensics
- Threat hunting
- Malware analysis
- Root cause analysis
- NDR/EDR
- Playbook development
Certifications mentioned
- CISSP
- GIAC
The shape of the job
Technical depth
4/5
Pace
4/5
Ownership
3/5
Teamwork
4/5
Cyberend's reading of the listing, not the employer's own scores.
Application toolkit
Make your application count
See which requirements your CV meets and what is missing.
Your CV is used for this answer only and never stored.
Questions to prepare for
- 01Describe your process for triaging and investigating a critical security alert.
- 02How do you conduct root cause analysis after a security incident?
- 03What steps do you take to improve incident response playbooks?
- 04Explain your experience with SIEM tools and creating custom alerts.
About Mastercard
Mastercard Vocalink operates critical payments infrastructure in the UK, supporting secure digital transactions and related services.
Full job descriptionAs published by Mastercard
Our Purpose
Mastercard powers economies and empowers people in 200+ countries and territories worldwide. Together with our customers, we’re helping build a sustainable economy where everyone can prosper. We support a wide range of digital payments choices, making transactions secure, simple, smart and accessible. Our technology and innovation, partnerships and networks combine to deliver a unique set of products and services that help people, businesses and governments realize their greatest potential.
Title and Summary
Senior Security Monitoring and Response Analyst
Overview Mastercard Vocalink is looking for a driven and motivated Senior Security Operations Analyst with Incident Response capabilities, to contribute to securing critical payments infrastructure in the UK.
In this role you’ll be responsible for triaging alerts and responding to security incidents. When not actively engaged in ongoing incidents, the team works on the improvement and streamlining of the detection and response function.
Role Responsibilities
Providing monitoring coverage, triage and investigation of escalated alerts (T3) from various sources. Responding to cybersecurity incidents through critical thinking, defining, and applying playbook responses
Applying root cause analysis and lessons learned to improve security posture and processes
Working closely with security engineering, threat intelligence, insider threat and a managed SOC service, providing critical feedback to improve and automate monitoring and response
Strong collaboration with the team to develop knowledge base, playbook and use cases.
Proactive initiatives and project-related support by providing subject matter expertise
Ability to work independently as well as collaborate with different teams to assess impact, mitigate risk, and resolve security incidents.
Qualifications
Required Experience: Direct experience in a Security Operations Center (SOC). Experience working in an incident response or digital forensics role. Demonstrated experience with cybersecurity related disciplines, not limited to: e.g. vulnerability research, network traffic analysis, static and dynamic malware analysis, digital forensics, memory analysis, web-security and threat hunting.
Preferred Experience:
Experience in creating queries and alerts in a SIEM, preferably in SPL. Experience with Windows/Unix OS forensics. Experience with Cloud Security (Azure, AWS, GCP). Experience working with NDR/EDR solutions Familiarity with Indicators of Compromise (IoCs), Indicators of Attack (IoAs), ATT&CK Tools, Techniques and Procedures (TTPs). Strong interpersonal skills, including good communication with the ability to articulate ideas in a precise and concise manner. CISSP, GIAC certifications or equivalent.
The Ideal candidate is a technically inclined and experienced security specialist who enjoys working in a fast-paced collaborative team environment.
Corporate Security Responsibility
All activities involving access to Mastercard assets, information, and networks comes with an inherent risk to the organization and, therefore, it is expected that every person working for, or on behalf of, Mastercard is responsible for information security and must:
- Abide by Mastercard’s security policies and practices;
- Ensure the confidentiality and integrity of the information being accessed;
- Report any suspected information security violation or breach, and
- Complete all periodic mandatory security trainings in accordance with Mastercard’s guidelines.